5de2498a04e12c1d8421788570d73eed7ef95a6c29d738cd0488cb5275157ebc

Analysis

max time kernel
51s
max time network
175s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
16/03/2023, 02:32

Target

superexportMicrogravimetric.dll
Size

333KB
MD5

fab9f38606e0ce465fefa4061b4dddaa
SHA1

5ea271c6688f8aae84146e7456aeb20abde0bf83
SHA256

d33601bac1fb8c11f659f102505a2e0e5280bf1fc7b525e57532488a53d2e2f7
SHA512

4b5e2b67059a822d61d78b063613d209d0d79d7a61b86bdbbf688e4c1aafee328dde6d2463469a1e3a6da660f8fdefa009e0348e9399a3d902b3436386072789
SSDEEP

6144:1aaVzaA4R+aU/P/IvTDp3ZZ99GSrtMhsNW9BUW/aSFGMReiDhKRIbGjpDY0RppeO:O+aU/P/IvTDp3ZZ99RrtMU2GSYIajK8J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4280	4476	WerFault.exe	66

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4476	4460	rundll32.exe	66
PID 4460 wrote to memory of 4476	4460	rundll32.exe	66
PID 4460 wrote to memory of 4476	4460	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\superexportMicrogravimetric.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\superexportMicrogravimetric.dll,#1
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 592
    3⤵
    - Program crash
    PID:4280